Vulnerability Report: Unauthenticated MQTT Broker Access in Molekule IoT Air Purifiers

Summary Security Vulnerability Disclosure Vendor: Molekule Group, Inc. Product Line: Molekule Air Purifier Date of Discovery: 25-10-2025 Date of Report: 30-10-2025 Last Updated: 28-01-2026 An unauthenticated attacker could access Molekule’s AWS IoT Core MQTT broker and subscribe to wildcard topics, receiving real-time device shadow updates from approximately 100,000 deployed IoT devices globally.…